Crypto bridges explained: how tokens move between blockchains, and why bridges get hacked

Crypto doesn’t live on one blockchain. Ether is on Ethereum, but you might want to use it on a cheaper layer 2 network. Bitcoin lives on bitcoin’s blockchain, but some people want to use a version of it in Ethereum apps. The tools that move value between these separate systems are called bridges.

Bridges are useful, sometimes essential. They’ve also been the target of some of the largest thefts in crypto. This guide explains how they work, the main designs, what can go wrong and how to use them more safely.

What a bridge does

ethereum.org compares a blockchain bridge to a physical one: just as a bridge connects two places, a blockchain bridge connects two blockchain ecosystems, letting them exchange information and assets.

Its example: if you’re travelling from the US to Europe, you swap dollars for euros at a currency exchange. If you want to use your ETH on a different network, such as moving it from Ethereum to a layer 2, you need a mechanism to do the same. That’s a bridge. See what is a layer 2?

How bridges move tokens

ethereum.org describes three main methods:

1. Lock and mint. Your tokens are locked on the source chain, and an equivalent amount is minted on the destination chain.
2. Burn and mint. Tokens are burned on the source chain and minted on the destination chain.
3. Atomic swaps. You swap your assets on one chain for another party’s assets on the other chain.

Lock and mint explains why bridges are such a target: the locked tokens sit in one place, often in very large amounts. The tokens minted on the other side are only as good as that pool. ethereum.org warns of systemic risk, because many bridges mint wrapped versions of assets, and wrapped tokens have been exploited.

Types of bridges

ethereum.org groups bridges in a few ways:

• Native bridges are built for a specific network to make it easy to move funds in, such as the official bridge of a layer 2 network.
• Validator or oracle-based bridges rely on an external group of validators or oracles to confirm transfers.
• Generalized message passing bridges can move assets along with messages and data between chains.
• Liquidity networks focus on moving assets from one chain to another through atomic swaps, generally without passing messages.

The more important distinction for users is trusted vs trustless:

What can go wrong

ethereum.org says bridges are still in the early stages of development, and lists the risks of using any bridge:

• Smart contract risk: a bug in the code can cause funds to be lost. Even audited bridges can be exposed by a single flaw. See what is a smart contract?
• Technology risk: software failures, human error, spam and attacks can disrupt operations.
• Censorship risk (trusted bridges): operators could stop users from transferring assets.
• Custodial risk (trusted bridges): operators could collude to steal users’ funds.
• User error: sending to the wrong address or network.

Your funds are at risk, ethereum.org adds, if there’s a bug in the contract, you make a mistake, an underlying blockchain is hacked, the operators of a trusted bridge act maliciously, or the bridge itself is hacked.

The hacks

The record is sobering:

• ethereum.org says bridges account for the top three biggest hacks in DeFi.
• It cites the Wormhole bridge, where 120,000 wETH, about $325 million, was stolen.
• The US Treasury says the mixer Tornado Cash was used to launder more than $96 million from the 24 June 2022 Harmony Bridge heist.
• Treasury also says North Korea’s state-sponsored Lazarus Group carried out what was then the largest virtual currency heist to date, worth almost $620 million, from a blockchain project linked to the online game Axie Infinity.

Bridges and laundering

Bridges also matter after a theft. The US Treasury’s 2023 DeFi risk assessment found that criminals laundering stolen funds sometimes use cross-chain bridges to swap assets for others on different blockchains, making them harder to follow.

The FBI saw this pattern after the theft of about $1.5 billion from the exchange Bybit around 21 February 2025, which it attributed to North Korea. It said the attackers moved quickly, converting some of the stolen assets to bitcoin and other assets spread across thousands of addresses on multiple blockchains. It urged node operators, exchanges, bridges, analytics firms and DeFi services to block transactions linked to the addresses involved.

When a bridge that holds locked assets is drained, the wrapped tokens it issued can be left without full backing, and that can affect anyone holding them, not only people who used the bridge. This is the systemic risk ethereum.org warns about.

How to use a bridge more safely

1. Ask whether you need one. If your exchange supports withdrawals directly on the network you want, that may be simpler. Check the network carefully on both sides.
2. Prefer the network’s official, native bridge, reached from the network’s own website rather than a search ad or a link in a message. See fake crypto apps and phishing.
3. Understand the trust model. Is it run by a company or a small group of signers, or does it rely only on the chains themselves?
4. Use independent research. ethereum.org points users to L2BEAT’s bridge risk analysis.
5. Send a small test amount first, and check it arrives.
6. Check your approvals. Bridges are smart contracts; don’t grant unlimited token approvals, and revoke ones you no longer need. See token approvals and how to revoke them.
7. Don’t leave large sums in wrapped tokens longer than you need to.
8. Beware of fake support. If a transfer is delayed, check its status yourself. Nobody legitimate needs your seed phrase. See seed phrase security.

Taxes

Moving tokens through a bridge can raise tax questions, especially if you receive a different, wrapped token rather than the same asset.

United Kingdom. HMRC’s manual addresses this directly. It explains that a token can’t really move from one blockchain to another (a bitcoin can’t exist on Ethereum), so a bridge achieves an effect comparable to a swap: you send tokens to an address you don’t control and receive an equivalent amount of a different token. Whether that counts as a disposal for Capital Gains Tax, HMRC says, depends on the facts. For some one-way transfers that can’t be reversed, HMRC’s view is that your original cost carries over in full to the new token, with a gain or loss arising only when you later dispose of it.

United States. The IRS has listed wrapping and unwrapping transactions among those that brokers don’t have to report on Form 1099-DA until further guidance is issued. That’s a reporting exception for brokers, not a statement that the transactions are tax-free. Keep records of every transfer, and see our guides for the US, the UK and Canada.

For related reading, see how to send crypto safely and what is DeFi?